Re: snort 1.9.0 + redhat 8.0: no output to mysql when in daemon mode

[Erek Adams <erek () snort org>]

On Fri, 21 Mar 2003, Tom Van Overbeke wrote:

First off:  Upgrade to 1.9.1.  1.9.0 has a security flaw with the RPC
decoder that is remotely exploitable.

> Snort refuses to write to mysql when it is started with the -A fast and
> the -D options. i tried all possible combinations, and as soon as one of
> these 2 parameters is mentioned, it defaults to the logfile.
>
> the -A i can do without, but i like to start all my daemons via the init.d
> scripts, and if i leave out the -D, snort remains attached to the terminal,
> which is not what a daemon should be doing.
>
> Does anyone know how I can have the -D option present and still log to
> database ?
>
> these are my snort.conf lines with respect to the output:
>
> output database: log, mysql, user=snort password=snort dbname=snort
> host=127.0.0.1
> output database: alert, mysql, user=snort password=snort dbname=snort
> host=127.0.0.1

I think your problem is quite as it appears.  Make sure you can log to the
DB at all.  I'm thinking that you are getting an error, and since -D kills
most of the output, you're not seeing the error.  Try to start with just:

        snort <options>

And don't have the -D in there.  See if it can log to your DB and if you
can see the data.  If so, try starting it with -D to see if you still get
data.  I have a feeling that you're not getting any data in there at
all....

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users